CVE Intelligence

Azure Access Technology vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Azure Access Technology products: 39 record(s), with severity, exploitation and fixes.

BLU-IC2 39BLU-IC4 39

Exploited only (KEV) →

CVE-2025-12275 Critical · 9.8 CWE-20 Oct 26, 2025
Mail Configuration File Manipulation + Command Execution
Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12221 High · 8.8 CWE-352 Oct 25, 2025
CSRF Token not Properly Implemented
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12220 Critical · 9.8 Oct 25, 2025
Busybox 1.31.1 - Multiple Known Vulnerabilities
Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12219 Critical · 9.8 Oct 25, 2025
Vulnerable Components in Azure Access OS
Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12218 Critical · 9.1 CWE-1392 Oct 25, 2025
Weak Default Credentials
Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12217 Critical · 9.1 CWE-1392 Oct 25, 2025
SNMP Default Community String (public)
SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12216 Medium · 5.5 CWE-1301 Oct 25, 2025
Malicious / Malformed App can be Installed but not Uninstalled
Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12176 Critical · 9.8 CWE-1242 Oct 24, 2025
Undocumented Administrative Accounts
Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12114 Medium · 5.5 CWE-1191 Oct 23, 2025
Serial Console Enabled
Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12104 Critical · 9.8 CWE-1104 Oct 23, 2025
Incorrect Content-Type Header
Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12031 Medium · 5.3 CWE-1004 Oct 21, 2025
HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute
HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-12001 Medium · 6.1 CWE-79 Oct 20, 2025
Incorrect Content-Type Header
Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11925 Medium · 6.1 CWE-754 Oct 17, 2025
Incorrect Content-Type Header
Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11832 Critical · 9.8 CWE-770 Oct 15, 2025
APIs Lack Rate Limiting
Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.